CVE-2023-28343
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in...
CVE-2023-28343 is a critical vulnerability (CVSS 9.8) in Apsystems Energy Communication Unit Firmware, published March 14, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 84.8%, the 99th percentile. No source names a fixed version.
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
- Record
CVE-2023-28343- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
- Record
CVE-2023-28343- Updated
- 2026-11-02
EUVDEUVD-2023-32041
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
- Record
EUVD-2023-32041- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-77pg-3832-hjf8
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in...
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.
- Record
GHSA-77pg-3832-hjf8- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Altenergy Power Control Software C1.2.5 - OS command injection | 2023-04-08 |
| Nuclei | Altenergy Power Control Software C1.2.5 - Remote Command Injection | |
| PoC in GitHub | gobysec/CVE-2023-28343 | 2023-03-21 |
| PoC in GitHub | superzerosec/CVE-2023-28343 | 2023-03-23 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, PoC in GitHub |